共收录 62 条相关情报。
← 返回所有主题CVE-2026-61592
### Impact SSE sessions were keyed solely by a **client-chosen** `session_id` with no binding to the authenticated user
CVE-2026-69214
When processing a `Set-Cookie` from a response, the `CookieJar` client middleware trusts the server-supplied `Domain` at
CVE-2026-69214
Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a
CVE-2026-1758
Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects Ga
CVE-2026-86279
A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impa
CVE-2026-85238
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a us
CVE-2026-85238
MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a us
CVE-2026-18527
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker t
CVE-2026-18527
IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker t
CVE-2026-81826
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This m
CVE-2026-81826
Affected versions of Flowintel do not revoke existing authenticated sessions when a user’s password is changed. This m
CVE-2026-70594
### Impact Ghost Admin did not invalidate existing sessions on login which could have allowed for session fixation atta
CVE-2026-69245
Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of
CVE-2026-69245
### Impact `SetCookie::matchesDomain()` gives every subdomain of a cookie `Domain` that cookie unless it recognizes the
CVE-2026-16496
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful t
CVE-2026-16496
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful t
CVE-2026-16496
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful t
CVE-2021-32088
An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. Certain API endpoints contain a rate-
CVE-2026-59883
### Impact `CookieJar` does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored
CVE-2026-59883
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bar